Firmware TLS support

Overview

The target for this article are the current product line (having firmware of the form: AAAAA.xxx.yyy (for example: MXTBD.081.215) and the previous (2012) product line (having firmware of the form: Lwxx.yy.Pzzz (for example: LW80.GM7.P222).

TLS is used to securely encapsulate data in multiple areas in Lexmark printers. Frequently, multiple versions are supported to some maximum level which is typically the default. When a connection involving TLS is created, a negotiation occurs between the “server” and the “client” to determine what level of TLS they can agree upon. It will try to use the highest allowed level but if the other side doesn’t support that level, they can choose a lesser version.

To restrict the level of TLS to the most current (default), the other levels need to be disabled on the server side. On Lexmark printers, all uses of TLS are “clients” except for EWS connections. EWS provides a server to handle connections. In this case, a set of checkboxes are provided to disable / enable non-default levels of TLS. This setting has no effect on client uses of TLS in the printer. Disabling lower levels of TLS for clients would have to be done on the server side of the connection.

Supported Versions of TLS

Note:  TLS supported connections (* indicates default)

Process	TLS Version	Previous Gen (EC8)	Current Gen (FW7)	Current Gen (FW8)
EWS / HTTPS (server)	1.3			*
	1.2	*	*
	1.1
	1.0
802.1x / AES (client)	1.3
	1.2		*	*
	1.1	*
	1.0
LDAP (client)	1.3			*
	1.2	*	*
	1.1
	1.0
SMTP (client)	1.3			*
	1.2	*	*
	1.1
	1.0
HTTPS for pullprint etc. (client)	1.3			*
	1.2	*	*
	1.1
	1.0
HTTPS for apps (client)	1.3			*
	1.2	*	*
	1.1
	1.0